Analysis
- max time kernel
188s - max time network
198s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
17/02/2022, 02:25
Static task
static1
Behavioral task
behavioral1
Sample
62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe
- Size 1.3MB
- Sample220217-cwlasahbdk
- SHA256 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937
- MD5 3cb934cc1ef83521d8bce144b0b100aa
- SHA1 6a987b0b14bd70fd48f6693ce82db53e6eb60427
- SHA512 a3a873af31d50340454030c04b50b2577aadc1b64de7609e63e571d11b668f3fc407d7fe76e86342995d109910f13be954a60fe5737ccd8da5f55876dfbe94e2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
wealth.warzonedns.com:5202
Signatures
- NetWire RAT payload 9 IoCs
resource yara_rule behavioral2/files/0x0003000000021425-130.dat netwire behavioral2/files/0x0003000000021425-131.dat netwire behavioral2/files/0x0003000000021428-141.dat netwire behavioral2/files/0x0003000000021428-140.dat netwire behavioral2/files/0x0003000000021429-144.dat netwire behavioral2/files/0x0003000000021429-145.dat netwire behavioral2/files/0x0003000000021425-146.dat netwire behavioral2/files/0x0003000000021429-154.dat netwire behavioral2/files/0x0003000000021425-157.dat netwire - WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 4 IoCs
resource yara_rule behavioral2/memory/2132-133-0x00000000004A0000-0x00000000004BD000-memory.dmp warzonerat behavioral2/memory/2132-142-0x00000000004A0000-0x00000000004BD000-memory.dmp warzonerat behavioral2/memory/1992-147-0x0000000000380000-0x000000000039D000-memory.dmp warzonerat behavioral2/memory/1992-155-0x0000000000380000-0x000000000039D000-memory.dmp warzonerat - Executes dropped EXE 5 IoCs
pid Process 3284 Blasthost.exe 3836 Host.exe 1676 RtDCpl64.exe 1612 Blasthost.exe 1992 RtDCpl64.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation RtDCpl64.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2908 set thread context of 2132 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 60 PID 1676 set thread context of 1992 1676 RtDCpl64.exe 79 - autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0003000000021429-144.dat autoit_exe behavioral2/files/0x0003000000021429-145.dat autoit_exe behavioral2/files/0x0003000000021429-154.dat autoit_exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3700 schtasks.exe 2688 schtasks.exe - Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.129966" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.250575" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4124" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe Token: SeRestorePrivilege 1812 TiWorker.exe Token: SeSecurityPrivilege 1812 TiWorker.exe Token: SeBackupPrivilege 1812 TiWorker.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3284 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 59 PID 2908 wrote to memory of 3284 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 59 PID 2908 wrote to memory of 3284 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 59 PID 2908 wrote to memory of 2132 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 60 PID 2908 wrote to memory of 2132 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 60 PID 2908 wrote to memory of 2132 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 60 PID 2908 wrote to memory of 2132 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 60 PID 2908 wrote to memory of 2132 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 60 PID 3284 wrote to memory of 3836 3284 Blasthost.exe 61 PID 3284 wrote to memory of 3836 3284 Blasthost.exe 61 PID 3284 wrote to memory of 3836 3284 Blasthost.exe 61 PID 2908 wrote to memory of 3700 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 62 PID 2908 wrote to memory of 3700 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 62 PID 2908 wrote to memory of 3700 2908 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 62 PID 2132 wrote to memory of 3092 2132 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 64 PID 2132 wrote to memory of 3092 2132 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 64 PID 2132 wrote to memory of 3092 2132 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 64 PID 2132 wrote to memory of 3092 2132 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 64 PID 2132 wrote to memory of 3092 2132 62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe 64 PID 1676 wrote to memory of 1612 1676 RtDCpl64.exe 78 PID 1676 wrote to memory of 1612 1676 RtDCpl64.exe 78 PID 1676 wrote to memory of 1612 1676 RtDCpl64.exe 78 PID 1676 wrote to memory of 1992 1676 RtDCpl64.exe 79 PID 1676 wrote to memory of 1992 1676 RtDCpl64.exe 79 PID 1676 wrote to memory of 1992 1676 RtDCpl64.exe 79 PID 1676 wrote to memory of 1992 1676 RtDCpl64.exe 79 PID 1676 wrote to memory of 1992 1676 RtDCpl64.exe 79 PID 1992 wrote to memory of 1012 1992 RtDCpl64.exe 80 PID 1992 wrote to memory of 1012 1992 RtDCpl64.exe 80 PID 1992 wrote to memory of 1012 1992 RtDCpl64.exe 80 PID 1676 wrote to memory of 2688 1676 RtDCpl64.exe 82 PID 1676 wrote to memory of 2688 1676 RtDCpl64.exe 82 PID 1676 wrote to memory of 2688 1676 RtDCpl64.exe 82 PID 1992 wrote to memory of 1012 1992 RtDCpl64.exe 80 PID 1992 wrote to memory of 1012 1992 RtDCpl64.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe"C:\Users\Admin\AppData\Local\Temp\62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:3836
-
-
-
C:\Users\Admin\AppData\Local\Temp\62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe"C:\Users\Admin\AppData\Local\Temp\62dbdb9e51357d2a34b944335228fe74b3b8eb66ae2384253fde5f53482b0937.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:3092
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3700
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3544
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Modifies data under HKEY_USERS
PID:1852
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:1612
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:1012
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2688
-